Linux|编译最新版的openssh-server-9.3的rpm包（一）

前言：

openssh服务的重要性不需要在这里废话了，而面对各种系统漏洞服务漏洞，我们最好的应对手段就是升级了，因此，我们的服务器很可能有升级内核的需求，以及升级系统内的重要服务的需求，而作为与服务器交互的服务sshd来说，漏洞也是非常多的，但该服务是基础服务，是不可能停止的，因此，我们需要升级它。

那么，如果只是单独的几个服务器，使用的是带有漏洞的低版本的sshd服务，手动的编译安装将该服务升级是可以实现的（通常，手工编译一个sshd服务也就最多半小时，包括测试环节），而如果有若干个服务器都需要升级，那么，显然手动编译升级的方式是不太现实的，太耗时费力了。

因此，在有大量的同一操作系统的服务器的情况下，显然编译一个适用于自身情况的sshd服务安装rpm包是比较合适的，可以节约大量的编译时间（一次编译，到处运行），并且可以结合脚本进行批量部署，从而提升运维的效率。

那么，本文将就如何在centos7下编译一个可用于centos7，升级sshd服务到最新版本的9.3做一个示例演示。

示例服务器的系统版本：

[root@k8s-node2 x86_64]# cat /etc/redhat-release 
CentOS Linux release 7.4.1708 (Core) 

####注：编译出来的rpm包适用于所有centos7或者redhat7以及等同于centos7的欧拉操作系统 

一，

创建相关目录

这些目录主要是存放源码包和编译出来的rpm包

[root@k8s-node2 ~]# mkdir -p /root/rpmbuild/SOURCES
[root@k8s-node2 ~]# mkdir -p /root/rpmbuild/SPECS
[root@k8s-node2 ~]# cp openssh-9.3p1.tar.gz   /root/rpmbuild/SOURCES/

二，

制作rpm的准备工作

#安装必要的包，关键的包是rpm-build, 其它的是依赖
  yum install rpm-build zlib-devel openssl-devel gcc perl-devel pam-devel unzip libXt-devel imake gtk2-devel -y

#解压tar包
  cd /root/rpmbuild/SOURCES/
  wget https://mirrors.aliyun.com/pub/OpenBSD/OpenSSH/portable/openssh-9.3p1.tar.gz
  tar -zxf openssh-9.3p1.tar.gz 
#复制出官方提供的spec文件，rpm-build需要根据这个文件来制作rpm包
  cp openssh-9.3p1/contrib/redhat/openssh.spec .
#关掉no_gnome_askpass no_x11_askpass这两个参数
  sed -i -e "s/%define no_x11_askpass 0/%define no_x11_askpass 1/g" openssh.spec
  sed -i -e "s/%define no_gnome_askpass 0/%define no_gnome_askpass 1/g" openssh.spec

三，

开始rpm包的制作

主要命令是：

rpmbuild -ba openssh.spec

###由于编译工作可能会有非常多的错误，因此，本次编译工作使用试错法，也就是直接开始，有错就解决，直到编译工作完成。

####下面对编译中的错误做一个总结

错误1：

[root@k8s-node2 SOURCES]# rpmbuild -ba openssh.spec
error: File /root/rpmbuild/SOURCES/x11-ssh-askpass-1.2.4.1.tar.gz: No such file or directory

两个方案任选一个即可 

解决方案1：

请前往网址：

https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz/

下载tar包然后手动上传到/root/rpmbuild/SOURCES/就可以了

不用wget的原因是wget下载的tar包在rpmbuild执行时解压会报错，下载后tar -zxf无法执行，只能手动下载然后上传

解决方案2：

屏蔽掉askpass，但还是需要下载x11-ssh-askpass-1.2.4.1.tar.gz在当前目录

sed -i -e "s/%global no_x11_askpass 0/%global no_x11_askpass 1/g" openssh.spec
wget https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz

错误2：

openssl开发包版本过高

[root@k8s-node2 SOURCES]# rpmbuild -ba openssh.spec
error: Failed build dependencies:
	openssl-devel < 1.1 is needed by openssh-9.3p1-1.el7.centos.x86_64

经检查，确实openssl的开发包版本过高，但卸载该包将会引起一些不必要的麻烦（openssl是一个比较重要的内置软件） 

[root@k8s-node2 SOURCES]# rpm -qa |grep openssl
openssl-libs-1.0.2k-8.el7.x86_64
openssl-1.0.2k-8.el7.x86_64
xmlsec1-openssl-1.2.20-5.el7.x86_64
openssl-devel-1.0.2k-8.el7.x86_64

解决方案：

编译前忽略openssl开发包的检查，也就是注释检查行

sed -i '/openssl-devel < 1.1/s/^/#/' openssh.spec

编译是比较快的啊，啪的一下就好了，编译出来的rpm包在以下目录，以下rpm包拿到其它同操作系统的服务器就可以愉快的安装使用了：

[root@k8s-node2 SOURCES]# cd ../RPMS/x86_64/
[root@k8s-node2 x86_64]# ls
openssh-9.3p1-1.el7.centos.x86_64.rpm                openssh-clients-9.3p1-1.el7.centos.x86_64.rpm    openssh-server-9.3p1-1.el7.centos.x86_64.rpm
openssh-askpass-gnome-9.3p1-1.el7.centos.x86_64.rpm  openssh-debuginfo-9.3p1-1.el7.centos.x86_64.rpm

正常的编译输出，尾部如下：

。。。。。。。。前面的略略略。。。。。。。。。。。
bpango-1.0.so.0()(64bit) libpangocairo-1.0.so.0()(64bit) libpangoft2-1.0.so.0()(64bit) libpthread.so.0()(64bit) rtld(GNU_HASH)
Obsoletes: ssh-extras
Processing files: openssh-debuginfo-9.3p1-1.el7.centos.x86_64
Provides: openssh-debuginfo = 9.3p1-1.el7.centos openssh-debuginfo(x86-64) = 9.3p1-1.el7.centos
Requires(rpmlib): rpmlib(FileDigests) <= 4.6.0-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= 3.0.4-1
Checking for unpackaged file(s): /usr/lib/rpm/check-files /root/rpmbuild/BUILDROOT/openssh-9.3p1-1.el7.centos.x86_64
Wrote: /root/rpmbuild/SRPMS/openssh-9.3p1-1.el7.centos.src.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/openssh-9.3p1-1.el7.centos.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/openssh-clients-9.3p1-1.el7.centos.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/openssh-server-9.3p1-1.el7.centos.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/openssh-askpass-gnome-9.3p1-1.el7.centos.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/openssh-debuginfo-9.3p1-1.el7.centos.x86_64.rpm
Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.JgTTnt
+ umask 022
+ cd /root/rpmbuild/BUILD
+ cd openssh-9.3p1
+ rm -rf /root/rpmbuild/BUILDROOT/openssh-9.3p1-1.el7.centos.x86_64
+ exit 0

通用的sshd配置文件，该配置文件直接复制后在shell里执行就可以覆盖生成配置文件了

cat >/etc/ssh/sshd_config<<EOF

#     $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $



# This is the sshd server system-wide configuration file.  See

# sshd_config(5) for more information.



# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/openssh/bin



# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented.  Uncommented options override the

# default value.



#Port 22

Port 10022

#AddressFamily any

#ListenAddress 0.0.0.0

#ListenAddress ::



#HostKey /usr/local/openssh/etc/ssh_host_rsa_key

#HostKey /usr/local/openssh/etc/ssh_host_ecdsa_key

#HostKey /usr/local/openssh/etc/ssh_host_ed25519_key



# Ciphers and keying

#RekeyLimit default none



# Logging

#SyslogFacility AUTH

#LogLevel INFO



# Authentication:



#LoginGraceTime 2m

#PermitRootLogin yes

#StrictModes yes

#MaxAuthTries 6

#MaxSessions 10



#PubkeyAuthentication yes



# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2

# but this is overridden so installations will only check .ssh/authorized_keys

AuthorizedKeysFile .ssh/authorized_keys



#AuthorizedPrincipalsFile none



#AuthorizedKeysCommand none

#AuthorizedKeysCommandUser nobody



# For this to work you will also need host keys in /usr/local/openssh/etc/ssh_known_hosts

#HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# HostbasedAuthentication

#IgnoreUserKnownHosts no

# Don't read the user's ~/.rhosts and ~/.shosts files

#IgnoreRhosts yes



# To disable tunneled clear text passwords, change to no here!

#PasswordAuthentication yes

#PermitEmptyPasswords no



# Change to no to disable s/key passwords

#ChallengeResponseAuthentication yes



# Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes

#KerberosGetAFSToken no



# GSSAPI options

#GSSAPIAuthentication no

#GSSAPICleanupCredentials yes



# Set this to 'yes' to enable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication.  Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

#UsePAM no



#AllowAgentForwarding yes

#AllowTcpForwarding yes

#GatewayPorts no

#X11Forwarding no

#X11DisplayOffset 10

#X11UseLocalhost yes

#PermitTTY yes

#PrintMotd yes

#PrintLastLog yes

#TCPKeepAlive yes

#PermitUserEnvironment no

#Compression delayed

#ClientAliveInterval 0

#ClientAliveCountMax 3

#UseDNS no

#PidFile /var/run/sshd.pid

#MaxStartups 10:30:100

#PermitTunnel no

#ChrootDirectory none

#VersionAddendum none



# no default banner path

#Banner none



# override default of no subsystems

Subsystem   sftp   /usr/libexec/openssh/sftp-server



# Example of overriding settings on a per-user basis

#Match User anoncvs

#     X11Forwarding no

#     AllowTcpForwarding no

#     PermitTTY no

#     ForceCommand cvs server

PermitRootLogin yes

PubkeyAuthentication yes

EOF